Memory Forensics for Artefacts Recovery from Ether Transactions

Use of cryptocurrencies in crimes like money laundering, ransomware, narcotics trade and terror funding has been on increase. There is a disturbing trend in the use of the cryptocurrencies even in conventional crimes like cheating, scams and financial frauds. The existing research in digital forensics of cryptocurrencies is dominated by Bitcoin and very less work has been done on digital artefacts identification in Ether transactions. There has been use of Ethereum in many criminal activities hence the knowledge of Ethereum forensics is very important for law enforcement agencies. According to Bankless Times, Ethereum is now used more than Bitcoin for illegal activities. The proportion of illicit transactions on the overall flow of Ethereum has risen to 0.33% versus 0.04% for bitcoin. In market capitalization, Ethereum is the second largest cryptocurrency. This paper is an endeavour to locate the digital artefacts related with Ether transactions in volatile memory. Cryptocurrency wallet “Exodus” has been used as it does not ask for KYC and such wallets are preferred by criminals. In all, 12 important digital artefacts were found in the volatile memory. As use of different cryptocurrencies other than Bitcoin is on rise in criminal activities, such research of digital artefacts identification with a given cryptocurrency will prove helpful for law enforcement agencies.